According to one general aspect, a non-transitory computer readable medium includes instructions that, when executed by at least one processor, cause a computing device to read a string of a log file for an application, where the log file comprises multiple strings of log data, compare the string to signatures stored in a memory to find a matching signature, where each of the signatures is encoded with a signature identifier (ID), determine a deviation between the string and the matching signature, encode the string with the signature identifier (ID) of the matching signature and the deviation, and transfer the string to a destination computing device using the signature identifier (ID) of the matching signature, the deviation, and a timestamp of the string.